@mmerterden/multi-agent-pipeline 15.16.0 → 16.0.0

package/CHANGELOG.md

@@ -16,6 +16,130 @@ Internal file-layout changes that don't affect the slash-command surface are sti
 
 ## [Unreleased]
 
+## [16.0.0] - 2026-08-23
+
+### Removed
+
+- **`--dev` and the four `dev-*` commands.** They existed only to express one boolean - skip Analysis and Planning - and made the user learn four command names to say it. Depth is now a question the run asks itself.
+- **"Fast plus unattended" as a combination.** This is the part that is a behaviour change rather than a rename, so it is stated plainly: `dev-autopilot` and `dev-local-autopilot` have no equivalent. Autopilot may not ask questions, so something has to choose the depth, and an unattended run is the worst place to drop analysis and planning - nobody is watching to notice what the shortcut lost. A cron job or script on those names now picks: stay unattended and pay for the full pipeline, or stay fast and have a person present.
+- All four names ship as **redirect stubs** for one minor release. A stub prints where to go and runs no phase; the files are deleted in the next minor. Same two-step the `delete` → `uninstall` rename used in v12.0.0.
+
+### Added
+
+- **Phase 0 Step 7.5, the depth picker.** Full or Short, asked once, recommended from the `taskType` Step 7 already computed: `bugfix` / `chore` recommend Short, `feature` / `refactor` / `component` recommend Full. `/multi-agent` and `/multi-agent:local` ask it; both autopilot entries and analysis mode do not.
+- The question **names the caveat before the choice, not after**. When the intake carried an analysis document or a Figma reference, Short is the option that skips the only two phases that would turn that document into a task breakdown, and the user reads that inside the question.
+- **`smoke-pipeline-surface.sh`** - four entries, four stubs, no live `--dev` anywhere, the depth step passes `ASK_CHOICE_DEFAULT`, help lists only commands that exist, and the four downstream readers of `onlyDevelop` still read it. Both of its scanners carry a planted-probe self-test, so a green run means "scanned and clean" rather than "the pattern matched nothing".
+- **`smoke-analysis-mode.sh`** - 41 checks over the analysis mode: its phase set writes no code and runs no test, Phase 1 produces the document the pre-flights block on, both pre-flights read a status instead of aborting, the humanizer is invoked rather than approximated by a punctuation grep, the validator runs in every mode and fails closed, the open-question walk is reachable from Phase 2 and Phase 4, and Locked 30 still holds (no Figma access after the analysis phase, with a probe proving the detector can fire).
+
+### Changed
+
+- **`state.onlyDevelop` is untouched.** The whole point of routing the picker into the existing key is that nothing downstream had to change: Phase 2's pre-flight, Phase 3's model selection, `agent-state.schema.json` and `usage-report.mjs` all keep working, and only who sets the key is different. `smoke-pipeline-surface.sh` asserts all four still read it.
+- **Tracker tiles flip late instead of being pre-marked.** The tracker boots at Step -1 and the depth answer arrives at Step 7.5, so a Short run registers Phases 1 and 2 like any other and flips them to `skipped` when it learns. Pre-marking is forbidden by the ordering contract and produces a visually scrambled tile stack; this is the pattern the contract already prescribed for exactly this case.
+- `gen-mode-dispatch.mjs` no longer knows the four dev modes, and `smoke-mode-dispatch-drift.sh` asserts it **rejects** them - a generator that still answers `--mode=dev` is an invitation to restore the command.
+- `smoke-dev-mode-review.sh` → **`smoke-short-run-review.sh`**. Its concern survives the rename intact: the fast path reviews its own work. Analysis and planning shape work that has not happened yet, so an already-scoped task can skip them; review judges work that now exists and has no substitute.
+- Command inventory reads **51 files, 47 live commands**, and both numbers are derived. `smoke-command-inventory.sh` counts stubs by the H1 title rather than anywhere in the body, because `help` legitimately lists the retired names under a "Removed in v16.0.0" heading and counting it would report one stub too many with a straight face.
+- Three gates (`smoke-command-inventory`, `smoke-generate-issue`, `smoke-review-readiness`) were each asserting the exact inventory header string. Two now check only that it leads with the derived count: one string asserted in three places means a legitimate change has to be made three times, and the third gets forgotten.
+- Help, modes, the tracker contract, both phase docs, the dispatcher, the cross-CLI contract, both READMEs, `docs/features.md` and `docs/architecture.md` all describe depth as a question. CHANGELOGs, `docs/internal/`, ROADMAP release entries and prefs migrations keep their `--dev` mentions: they record what was true when they were written, and rewriting that is how a changelog stops being evidence.
+
+### Fixed
+
+- **Fourteen files still pointed readers at the retired command names.** The first sweep of this release chased the `--dev` flag and missed the class beside it: a file can drop the flag and still say "run `/multi-agent:dev`", which now only prints a redirect. Both READMEs, the Copilot instruction template, the mode-comparison tables in `local-autopilot` (both trees), the Copilot orchestrator's phase-set list, `ios-coding-standard`, `resume-local`, `store-ready`, `rules.md`, Locked 30 and 31, the analysis template, `render.md`, the complaint template and command, and the complaint schema all named a command that no longer dispatches. `smoke-pipeline-surface.sh` gained check 5b for the class, with a planted probe and a one-line-of-context rule so a wrapped removal notice is not misread as a fresh pointer.
+- **The Copilot orchestrator's Phase 0 contract said "8 sequential interactive steps" and stopped there**, so a Copilot run had no instruction to ask the depth question at all. It now names Step 7.5 and who is exempt from it.
+- `update`'s sample output still claimed 205 skills and 228 scripts; the real numbers are 208 and 245.
+- The three generated indexes (`skills-index.md`, `.skills-index.json`, `shared/README.md`) were carrying the old command descriptions and skill counts; regenerated.
+- **`local` mode's Phase 5 was documented two ways.** `modes.md` said the local pipeline keeps the interactive test prompt; `gen-mode-dispatch.mjs --mode=local`, which is byte-equality-enforced against the command file, drops Phase 5 entirely. The generator is right - the gate hands the user a change checked out of a worktree, and local has no worktree - so both `modes.md` rows now say so.
+- **`cross-cli-contract.md` section 7 claimed Claude Code was macOS-only.** It has not been for some time, and the assumption it invited - that a Windows user necessarily arrives through Copilot or Codex - produces wrong conclusions about which code paths need to be portable.
+- The phase-4 telemetry block named as compression debt in v15.22.0 was collapsed to an `emit()` helper.
+
+## [15.22.0] - 2026-08-23
+
+### Added
+
+- **`ai-analyst-toolkit`, the second always-on plugin.** Analysis work needs facts the repo cannot supply: whether a dependency has a known upstream bug, what a release actually changed, whether anyone outside this team has reported the same symptom. Five skills answer those, and the plugin is enabled everywhere alongside `ai-common-toolkit` because none of the questions are stack-specific.
+- **Two tiers, kept apart on purpose.** EVIDENCE (`evidence-github`, `evidence-registry`) has a citable identity and may feed a specification body, cited `GitHub:<owner>/<repo>#<n>` or `Release:<pkg>@<version>`. SIGNAL (`signal-community`) is advisory and may only reach Section 20 Risks. A specification is reviewable because every claim in it can be checked; a forum post is one person's experience, and letting it into a requirements section makes the checkable and the anecdotal look identical.
+- **Access reflects what these sources actually allow in 2026.** GitHub goes through the already-authenticated `gh` CLI. npm, PyPI, Maven Central and Swift Package Index are keyless HTTP. Stack Overflow and Hacker News are keyless too, with HN search through `hn.algolia.com` because the official Firebase API has no search endpoint. Reddit closed self-service app registration in late 2025 and X discontinued its free tier for new developers, so both are reachable only through the host CLI's own web search: `prefs.global.analyst.webSignals`, off by default, best-effort, and exempt from cross-CLI parity for the same reason Figma component work is.
+- **Phase 1d in the analysis engine**, plus `evidence.outside[]` / `evidence.signals[]` in `analysis-spec.schema.json`. Signal is deliberately excluded from the Locked 27 evidence digest: it changes by the hour, so including it would produce a new digest every run and permanently invalidate the cache the digest exists to serve. The consequence is stated where it matters - a cache hit reuses yesterday's signal rows, and `--no-cache` is how you refresh them.
+- **Four other callers, all optional.** `refactor` Step 0 routes its GitHub / X / Reddit research through the skills instead of ad-hoc searching. The shared readiness review asks whether a reported bug is already open upstream, which changes the comment rather than the score. `complaint-analysis` can corroborate a complaint beyond one device. Phase 4 triage defers a finding that blames a third-party library, with its citation, instead of sending Phase 3 to fix code that is not ours.
+- **`prefs.global.analyst`** (`evidence[]`, `signals[]`, `webSignals`) and **`prefs.global.analysisPhase`** (`mode`, `forceFull`, `commitDoc`). The second block had been referenced by three phase docs since v15.17.0 without ever being declared.
+
+### Fixed
+
+- **`analysisPhase.forceFull` was declared-but-inert.** `smoke-prefs-consumed.sh` caught it the moment the schema landed: nothing read the key. Phase 1 Step 4 now names both it and `mode` in the when-table - one decides whether a document is produced, the other how deep it goes.
+- **`evidence.documents[]` had nowhere to land.** v15.20.0 added `fetch-document.sh` and a `document` link type, but `analysis-spec.schema.json` is `additionalProperties: false` and had no bucket for the result, and the Phase 1 fan-out table had no row for the type. Both exist now, and a document whose text could not be extracted stays in the list with `fetched: false` so Section 21 still cites it - dropping it would make the analysis read as if the file was never supplied. `standards.kind` accepts `document` too.
+- **Copilot and Codex silently lost every `ai-common-toolkit` skill whenever a repo named its stack.** `pluginsToDeliver()` derived the delivery set from `enabledPlugins` and kept only what it found there, so a `.claude/settings.json` listing `ai-ios-toolkit` alone dropped all 32 common-toolkit external skills (humanizer, firebase, council, search-first, the accessibility audit and five more) from both copy hosts. Claude Code loads them from the marketplace, so the loss was invisible on the one host with a plugin loader and total on the two without. The installer now unions an exported `ALWAYS_ON` set into every selection, and `smoke-install-layout.sh` imports that same constant instead of restating the enabled list - a hardcoded copy of it is what let the gate stay green through the whole regression.
+- **The document fetch was invisible in the progress contract.** `by-type` and the deep-fetch line now carry `document`, with a `degraded` outcome for the found-but-unreadable case (a PDF on a machine with no `pdftotext`).
+
+### Changed
+
+- `smoke-stack-skill-routing.sh` gained check 7: the always-on toolkits must be wired in every mechanism that carries them. "Always enabled" is not one switch - the routing table, the plugin builder, the installer (Copilot and Codex have no plugin loader, so a plugin missing there is simply absent) and the two SKILL files each fail silently on their own.
+- Description-surface ceiling 82600 -> 83400 and the paired literal in `context-budget-gate.test.mjs`. All three new descriptions were trimmed toward the average first; the average held at 320 against its 420 ceiling, which is this gate's own signal that the tree grew rather than that anything is padded.
+- Phase-doc aggregate 55800 -> 55900. Compression came first and three times, taking the new prose from 220 tokens to 110; the Phase 1d contract itself never entered this budget, because it lives in `multi-agent-refs/analysis/evidence.md`.
+
+## [15.21.0] - 2026-08-23
+
+### Added
+- **A confirmation pass that shows what was derived and asks only what was not.** Phase 2 Step 0.9 runs before planning: the platform set, the seven convention groups, the existing components, the localization keys and the analytics events all came out of the repos in Phase 1, so they are shown for confirmation rather than asked. Only Section 20 rows are asked, through the resolve engine, one row with at most three source-labeled candidates plus Defer - and never an invented one. It sits here rather than in Phase 4 because Phase 4 runs after development, where an answer arrives too late to change anything.
+- A corrected derived value rewrites its Pass B footnote as `^[user-override: resolved <date>]` (Locked 24), so where a value came from stays traceable even after a human overrode it.
+
+### Changed
+- **The analysis stopped asking for the platform.** Every repo selected in Phase 0 already carries a stack tag from the project scan, so the platform set is the distinct tags of the selected repos. It is derived and shown in the breadcrumb; the question survives only as a fallback for an untaggable repo or a user who wants fewer platforms than the repos imply.
+- **The analysis stopped asking for repos.** That was the third place asking the same thing - Phase 0 Step 2 selects projects, `_dev-context.md` adds editable siblings, and analysis re-derived its own list on top. Repos now come from Phase 0, and the platform-to-repo mapping falls out of the stack tags.
+- `prefs.projects[<key>].frontendRepos[]` moved into `_dev-context.md`. Only the analysis command read it, which meant the pipeline's own dev-context picker could never offer a frontend repo - they are rarely submodules, so submodule detection never finds them.
+- Phase-doc token budget: total 55500 -> 55800. Compression came first and twice, 430 tokens down to 250, by collapsing the derived-versus-asked explanation and leaving the walk itself in the ref that Phase 4 and `analysis-resolve` already mount.
+
+## [15.20.0] - 2026-08-23
+
+### Added
+- **The analysis can read a Word file now.** Nothing in the pipeline handled `.docx`, which is the format most feature specs actually arrive in - a spec had to be pasted or re-typed into Confluence before the analysis could cite it. `pipeline/lib/fetch-document.sh` handles `.docx`, `.pdf`, `.md` and `.txt`, as a local path or a URL, and the extractor gained a `document` type that recognises both. It is distinct from `generic-doc`, which is an HTML page: this one is a file that must be converted before it can be read.
+- **No new dependency for the common case.** A `.docx` is a zip, so `word/document.xml` is parsed with the python3 standard library the lib layer already requires; the same code path runs on macOS, Linux and Windows. Requiring pandoc or libreoffice would have been the wrong dependency for a tool that must work everywhere. PDF has no stdlib path: `pdftotext` is used when present and its absence is a soft skip (exit 6, `converter-not-available`), which on Windows is the normal case, not an error. The converter binary is configurable via `DOCUMENT_PDFTOTEXT`, which is also how the smoke exercises the degrade path without breaking `PATH`.
+- **The analysis test plan is now the TDD RED input.** Phase 3's pre-flight read the concept table and even claimed test method names come from the analysis, while nothing read Section 15 - so RED invented its own tests and the carefully written test matrix never reached development. Step 5b loads it into `state.dev.testPlan[]` and RED writes those rows. Phase 4 step 1.45 then cross-checks every planned row against a real test: missing is `important`, present-but-asserting-something-else is `blocking`. That is what makes "analysis quality is output quality" a finding rather than a slogan.
+
+### Fixed
+- The local-document matcher also matched the path inside a URL, so `https://x/api.pdf` produced a phantom local file `//x/api.pdf`. Matches overlapping a URL span are skipped; the smoke asserts a document URL yields exactly one entry.
+
+## [15.19.0] - 2026-08-23
+
+### Added
+- **Business rules are written in EARS now.** Section 4.4 rule statements were free prose, so Locked 31's "two readers must not disagree on pass/fail" was carried only by the acceptance criterion, not by the rule it came from. EARS (Easy Approach to Requirements Syntax, IEEE RE'09, five patterns) fixes the clause order and the keyword set, which is what removes the ambiguity. EARS states the rule, Gherkin still states how you check it - Locked 13 widens, it does not change.
+- **Section 15.7, manual test scenarios.** The pipeline already emitted this format as the Jira test-scenario comment from `resume-local`; the analysis had no place for it, so the document a QA engineer needs was the one thing the spec did not carry. Defined once, read by both. Every MT row carries its `BR-` id, and the validator enforces it: a scenario nobody can trace to a rule is a scenario nobody can tell is stale.
+- **Section 6.X is the whole variant axis, not the part this screen used.** New Phase 1b.2 walks each Code Connect-bound instance to its main component and reads `componentPropertyDefinitions`, so "used subset" finally has a set to be a subset of. Locked 29 promised this table for four releases with no step that could produce it. It has to happen in Phase 1: Locked 30 forbids Figma access afterwards, so an axis missed here is missed for the run.
+- **Three layer headings**: `Bölüm A - Analiz` (what to build), `B - Teknik Analiz` (what is true), `C - Geliştirme Analizi` (how to build it), with a boundary rule - remove the row, what becomes unclear - and the corollary that A carries no technology name and C no business rationale. Additive `#` headings only: section numbers are referenced in 172 places including two validators, so nothing renumbers, and Confluence gains a two-level table of contents for free.
+
+### Fixed
+- **A layer heading could have satisfied a required section.** `validate-analysis-doc.mjs` matched required sections by substring over every `#{1,3}` heading, so a layer named `Bölüm B - Mimari ve Teknik` would have reported the architecture requirement as met with Section 13 absent. The matcher now only reads numbered section headings. Caught while adding the headings, not after shipping them.
+
+### Changed
+- UI test scenarios default ON for `taskType == component` and for any task carrying a Figma reference. They were opt-in everywhere, so UI work started with UI tests switched off.
+- The doc validator gained the 15.7 and 6.X rules; `smoke-validate-analysis-doc.sh` grew from 10 to 13 assertions, one per new contract, each planted-and-proven rather than asserted.
+
+## [15.18.0] - 2026-08-22
+
+### Added
+- **`/multi-agent:analysis` is a pipeline mode now, not a command standing beside the pipeline.** It runs on the same 8-phase machinery - tracker tiles, `:resume`, the cost ledger, the channels report - with four phases reinterpreted the way `--dev` reinterprets Phase 3: Phase 3 and Phase 5 skip, Phase 4 reviews the document instead of a diff, Phase 6 publishes instead of committing. Phase set 0/1/2/4/6/7, generated by `gen-mode-dispatch.mjs --mode=analysis` and drift-checked like every other mode.
+- Phase 4 in analysis mode asks reviewers one question: could an implementer build the right thing from this document alone? A finding is anything that would force them to guess. The Section 20 walk runs there too, and a deferred row reports `review_blocking` rather than quietly staying open.
+- No `local` or `autopilot` variant, on purpose: worktree isolation buys nothing when no code is written, and the intake, the convention preview and the open-question walk are interactive by nature.
+
+### Changed
+- The engine keeps moving out of commands and into `multi-agent-refs/analysis/`: `intake.md` and `resolve.md` join `locked/evidence/synthesis/render`. `analysis-resolve` and pipeline Phase 4 now mount the same resolution walk instead of describing it twice, and `analysis/SKILL.md` fits under the 6000 hard cap that applied once its grace entry was retired.
+- Phase-doc token budget: total 54900 -> 55250. Compression came first and three times, twice on the new prose and once on old: both mode branches shrank by pointing at the refs that hold the actual walks, and the front-matter parse contract stopped being spelled out identically in two pre-flights.
+
+## [15.17.0] - 2026-08-22
+
+### Fixed
+- **The full pipeline demanded a document nothing produced.** Phase 2 and Phase 3 pre-flights have BLOCKED on `analysis/<feature-slug>-<platform>.md` since v9.0.0, and Phase 1 never wrote it - its output was `analysis.json`, a different artefact. So a full run either aborted at Phase 2 telling the user to go run `/multi-agent:analysis` by hand, or the model quietly ignored its own BLOCKING contract. Phase 1 Step 4 now produces the document, and both pre-flights read `state.analysis.docStatus` instead of guessing from the filesystem: `produced` / `reused` continue, `not-applicable` is a legitimate skip (bugfix or chore with no Figma reference), and only a contract breach aborts. Neither phase sends the user to another command any more, because producing the file is Phase 1's job.
+
+### Changed
+- **The analysis engine moved out of the command and into on-demand refs.** `multi-agent-refs/analysis/{locked,evidence,synthesis,render}.md` now carry the 31 Locked decisions, the evidence gathering, the two-pass synthesis and the render/publish flow. `/multi-agent:analysis` keeps them as its contract and Phase 1 loads the same four files, so there is one engine with two entry points rather than a command the pipeline cannot reach. Side effect worth naming: `analysis/SKILL.md` went from 18081 to 5974 tokens and its lint grace entry (ceiling 18500) is retired - the grace list only ratchets down.
+- Whether the document is produced is decided from signals Phase 0 already computed, so no new question: `feature` / `refactor` / `component` always, `bugfix` / `chore` only with a Figma reference. An existing document whose `evidence_digest` still matches is reused rather than regenerated (Locked 27).
+- `analysis-output.schema.json` gains `docStatus`, `docPath[]` and `openQuestions[]` - the fields the two pre-flights branch on.
+- Phase-doc token budget: total 54400 -> 54900. Compression came first and twice: the new step went from 745 tokens to 497 (its history moved to this entry, the per-ref descriptions moved into the refs' own headers), and the front-matter parse contract, spelled out identically in both pre-flights, now lives in `phase-3-dev.md` with `phase-2-planning.md` pointing at it. The 17.4k-token engine itself left the budget entirely by moving to refs.
+
+## [15.16.1] - 2026-08-22
+
+### Fixed
+- **The humanizer punctuation check never ran on macOS.** Two SKILL files told the agent to verify the emitted document with `grep -P '[\x{2013}...]'`. BSD grep has no `-P`, so on the pipeline's primary platform the command errored out and "returns zero matches" was trivially true - the policy's only mechanical check was a shipped no-op. Both now call the deterministic Node validator that already implements the same policy (`validate-analysis-doc.mjs`, `validate-complaint-doc.mjs`), which behaves identically on macOS, Linux and Windows.
+- The repo already banned `grep -P` (`smoke-shell-portability.sh`, "no guarded form"), and that gate was green the whole time: it only scanned `*.sh`. A markdown instruction file is executed too - an agent reads `grep -P ...` and runs it verbatim - so the scanner now covers `commands/`, `multi-agent-refs/` and `skills/` markdown as well. It distinguishes a prohibition from an invocation, so a line that forbids the construct still passes. Adding it immediately surfaced a second instance in `complaint-analysis/SKILL.md` that no one had noticed, which is the argument for the gate.
+
 ## [15.16.0] - 2026-08-22
 
 ### Added

package/README.md

@@ -42,7 +42,7 @@ Run a task - the input type is auto-detected:
 
 Every input runs the same short intake - **account → (repo) → maturity check → dev-context** - then enters Phase 0. A Jira id or GitHub URL is fetched and maturity-checked *before* any code is written; free-text skips the fetch and goes straight to planning. Multi-repo tasks add extra repos at the dev-context step.
 
-Add `autopilot` to skip confirmations, `--dev` for the fast dev-only path, or `--local` to work on the current branch without a worktree (e.g. `/multi-agent:autopilot "PROJ-1234"`).
+Add `autopilot` to skip confirmations, or `--local` to work on the current branch without a worktree (e.g. `/multi-agent:autopilot "PROJ-1234"`). Pipeline depth is a question the run asks, not a flag: `/multi-agent` and `/multi-agent:local` offer Full or Short at Phase 0.
 
 Update later with `/multi-agent:update`. Uninstall (tokens preserved) with `npx @mmerterden/multi-agent-pipeline uninstall`.
 
@@ -71,8 +71,8 @@ The discipline behind all of this - bounded loops, evidence gates, token-budgete
 |---|---|---|
 | Full | `/multi-agent "task"` | All 8 phases, interactive |
 | Autopilot | `/multi-agent:autopilot "task"` | 7 phases (interactive Test gate dropped), no confirmations |
-| Dev | `/multi-agent:dev "task"` | Init → Dev → Review → Test → Commit → Report |
 | Local | `/multi-agent:local "task"` | Full pipeline minus the interactive Test gate, current branch (no worktree) |
+| Depth | asked at Phase 0 Step 7.5 | Full (all phases) or Short (Dev → Review → Test → Commit → Report). Not a command name  -  `/multi-agent` and `:local` ask, both autopilot entries always run Full |
 | Ship | `/multi-agent:resume-local` | Run the review→test→commit→report tail over local work |
 | Audit | `/multi-agent:design-check` | Mock-mode vs Figma conformance, local-only |
 | Audit | `/multi-agent:testflight-validation` | Pre-submission gates for a TestFlight build: static archive audit → Apple's `altool --validate-app` → Review-Guidelines check. Validates only, never uploads |

package/README.tr.md

@@ -42,7 +42,7 @@ Bir görev çalıştır - girdi tipi otomatik algılanır:
 
 Her girdi aynı kısa intake'ten geçer - **hesap → (repo) → maturity kontrolü → dev-context** - sonra Phase 0'a girer. Bir Jira id'si veya GitHub URL'i hiçbir kod yazılmadan *önce* çekilir ve maturity-kontrol edilir; serbest-metin bu çekimi atlayıp doğrudan planlamaya geçer. Çoklu-repo görevleri dev-context adımında ekstra repo ekler.
 
-Onayları atlamak için `autopilot`, hızlı dev-only yol için `--dev`, ya da worktree olmadan mevcut branch'te çalışmak için `--local` ekle (örn. `/multi-agent:autopilot "PROJ-1234"`).
+Onayları atlamak için `autopilot`, worktree olmadan mevcut branch'te çalışmak için `--local` ekle (örn. `/multi-agent:autopilot "PROJ-1234"`). Pipeline derinliği artık bayrak değil, koşunun sorduğu bir soru: `/multi-agent` ve `/multi-agent:local` Faz 0'da Tam mı Kısa mı diye sorar.
 
 Sonra `/multi-agent:update` ile güncelle. Kaldırmak için (tokenlar korunur) `npx @mmerterden/multi-agent-pipeline uninstall`.
 
@@ -71,7 +71,6 @@ Bunun arkasındaki disiplin - sınırlı loop'lar, kanıt kapıları, token-büt
 |---|---|---|
 | Full | `/multi-agent "task"` | Tüm 8 faz, interaktif |
 | Autopilot | `/multi-agent:autopilot "task"` | 7 faz (interaktif Test kapısı atlanır), onaysız |
-| Dev | `/multi-agent:dev "task"` | Init → Dev → Review → Test → Commit → Report |
 | Local | `/multi-agent:local "task"` | İnteraktif Test kapısı hariç tam pipeline, mevcut branch (worktree yok) |
 | Ship | `/multi-agent:resume-local` | Lokal iş üzerinde review→test→commit→report kuyruğunu çalıştır |
 | Audit | `/multi-agent:design-check` | Mock-mode vs Figma uygunluğu, yalnızca lokal |

package/docs/architecture.md

@@ -38,8 +38,8 @@ graph LR
         N0[Init] --> N1[Analysis] --> N2[Planning] --> N3[Dev] --> N4[Review] --> N5[Test] --> N6[Commit] --> N7[Report]
     end
 
-    subgraph Dev ["Dev Mode (--dev, Opus)"]
-        D0[Init] --> D3[Dev<br/>Opus] --> D6[Commit] --> D7[Report]
+    subgraph Dev ["Short depth (picker, Opus)"]
+        D0[Init] --> D3[Dev<br/>Opus] --> D4[Review] --> D5[Test] --> D6[Commit] --> D7[Report]
     end
 
     subgraph Autopilot ["Autopilot (skip confirmations)"]

package/docs/ecosystem.md

@@ -29,6 +29,7 @@ graph LR
         FEP["ai-frontend-toolkit"]
         BEP["ai-backend-toolkit"]
         COMP["ai-common-toolkit"]
+        ANAP["ai-analyst-toolkit"]
     end
 
     subgraph DTK ["dev-toolkit-mcp (device/browser hands)"]
@@ -105,15 +106,17 @@ hand-authored *inside* `multi-agent-plugins` and are never touched by sync.
 
 ```mermaid
 graph TD
-    EXT["pipeline/skills/shared/external/<br/>151 skills - single authoring source<br/>(the pipeline's own phases read these too)"]
+    EXT["pipeline/skills/shared/external/<br/>154 skills - single authoring source<br/>(the pipeline's own phases read these too)"]
 
-    EXT -->|"cross-stack skills"| COMMONP["ai-common-toolkit<br/>10 skills · v0.2.3"]
-    EXT -->|"Apple/Xcode-only"| IOSP["ai-ios-toolkit<br/>145 skills · v0.6.0"]
-    EXT -->|"Android/Kotlin-only"| ANDP["ai-android-toolkit<br/>29 skills · v0.1.3"]
-    EXT -->|"backend-only"| BEP["ai-backend-toolkit<br/>32 skills · v0.1.4"]
-    EXT -->|"web/frontend-only"| FEP["ai-frontend-toolkit<br/>24 skills · v0.1.3"]
+    EXT -->|"cross-stack skills"| COMMONP["ai-common-toolkit<br/>11 skills · v0.2.7"]
+    EXT -->|"outside facts for analysis"| ANAP["ai-analyst-toolkit<br/>5 skills · v0.1.1"]
+    EXT -->|"Apple/Xcode-only"| IOSP["ai-ios-toolkit<br/>148 skills · v0.10.0"]
+    EXT -->|"Android/Kotlin-only"| ANDP["ai-android-toolkit<br/>30 skills · v0.1.4"]
+    EXT -->|"backend-only"| BEP["ai-backend-toolkit<br/>33 skills · v0.1.5"]
+    EXT -->|"web/frontend-only"| FEP["ai-frontend-toolkit<br/>25 skills · v0.1.4"]
 
     COMMONP --> BUMP{"skill set<br/>changed?"}
+    ANAP --> BUMP
     IOSP --> BUMP
     ANDP --> BUMP
     BEP --> BUMP

package/docs/features.md

@@ -26,10 +26,9 @@ Each phase reads its own spec file under `pipeline/multi-agent-refs/phases/phase
 | Flag        | Effect                                                                              |
 | ----------- | ----------------------------------------------------------------------------------- |
 | `autopilot` | Skip all confirmation prompts; still fails safe on review blockers + build retries. |
-| `--dev`     | Strip to Init → Dev(Opus self-contained) → Review → Test → Commit → Report. No Phase 1/2.       |
 | `--local`   | No worktree - works directly in `$PROJECT_ROOT` on a local branch.                  |
 
-Compose freely: `--dev --local autopilot` = shortest, least-friction path.
+Depth is not a flag. `/multi-agent` and `/multi-agent:local` ask Full or Short at Phase 0 Step 7.5, recommending from the detected `taskType`; Short strips to Init → Dev(Opus self-contained) → Review → Test → Commit → Report. Autopilot never asks and always runs Full - "fast plus unattended" was removed in v16.0.0, because something has to choose when nobody is asked and unattended is the worst place to drop analysis and planning.
 
 ### Stack Auto-Detection
 
@@ -45,7 +44,7 @@ Build commands, test runners, lint tools, and review focus areas all adapt to th
 
 ### Stack Selection (marketplace plugins)
 
-Stack skill sets ship as versioned plugins in the `multi-agent-plugins` marketplace. Selecting a stack enables the matching plugin(s) in the current repo's `.claude/settings.json` `enabledPlugins` - no skill copying, no session restart tricks, no directory shuffling. The `ai-common-toolkit` (accessibility audit, humanizer, Firebase) is always enabled alongside the stack plugin.
+Stack skill sets ship as versioned plugins in the `multi-agent-plugins` marketplace. Selecting a stack enables the matching plugin(s) in the current repo's `.claude/settings.json` `enabledPlugins` - no skill copying, no session restart tricks, no directory shuffling. Two toolkits are always enabled alongside the stack plugin because neither is stack-specific: `ai-common-toolkit` (accessibility audit, humanizer, Firebase) and `ai-analyst-toolkit` (GitHub and package-registry evidence, community signal).
 
 ```bash
 /multi-agent:stack ios         # ai-ios-toolkit (SwiftUI, Xcode, HIG)

package/install/_plugin-skills.mjs

@@ -35,15 +35,36 @@ import { copyDir, countFiles, ensureDir, ensureRealDir, isDryRun, wipeDir } from
 /** Subtrees a plugin authors itself. `knowledge/` is generated, so it is excluded. */
 const AUTHORED_GROUPS = Object.freeze(["index", "reference", "workflow", "tools"]);
 
-/** Stack plugins, and the platform each belongs to. */
+/**
+ * Stack plugins, and the platform each belongs to. The two `platform: "all"`
+ * toolkits that are not a stack at all - common and analyst - are here because
+ * this list drives DELIVERY, not enablement: Copilot and Codex have no plugin
+ * loader, so a plugin missing from this list is simply absent on those hosts no
+ * matter what any settings file says.
+ */
 const STACK_PLUGINS = Object.freeze([
   { name: "ai-ios-toolkit", platform: "ios" },
   { name: "ai-android-toolkit", platform: "android" },
   { name: "ai-frontend-toolkit", platform: "all" },
   { name: "ai-backend-toolkit", platform: "all" },
   { name: "ai-common-toolkit", platform: "all" },
+  { name: "ai-analyst-toolkit", platform: "all" },
 ]);
 
+/**
+ * Plugins that are enabled everywhere, whatever the repo selected.
+ *
+ * `stack/SKILL.md` and `setup/SKILL.md` both promise these two are always on,
+ * but a repo's `enabledPlugins` only has to name the stack plugin for that
+ * promise to be broken here: the settings-derived branch below would return the
+ * stack plugin alone, the external-skill partition would then drop every skill
+ * routed to common or analyst, and the authored delivery would skip them too.
+ * Claude Code would still load them from the marketplace, so the failure is
+ * invisible on the one host that has a plugin loader and total on the two that
+ * do not.
+ */
+export const ALWAYS_ON = Object.freeze(["ai-common-toolkit", "ai-analyst-toolkit"]);
+
 /**
  * Compare two semver-ish directory names, newest last.
  * @param {string} a
@@ -128,6 +149,7 @@ export function pluginsToDeliver(home, platformFlag) {
         .map(([k]) => k.split("@")[0])
         .filter((n) => STACK_PLUGINS.some((p) => p.name === n));
       if (enabled.length > 0) {
+        for (const n of ALWAYS_ON) if (!enabled.includes(n)) enabled.push(n);
         // Deterministic order, stack plugin before the shared one: on a name
         // collision the first delivery wins, and the stack-specific version is the
         // one the repo actually wants.
@@ -139,7 +161,11 @@ export function pluginsToDeliver(home, platformFlag) {
     }
   }
   const names = STACK_PLUGINS.filter(
-    (p) => p.platform === "all" || platformFlag === "all" || p.platform === platformFlag,
+    (p) =>
+      ALWAYS_ON.includes(p.name) ||
+      p.platform === "all" ||
+      platformFlag === "all" ||
+      p.platform === platformFlag,
   ).map((p) => p.name);
   return { names, source: `--platform=${platformFlag} default (no enabled plugin list found)` };
 }

package/install/templates/copilot-instructions.md

@@ -25,13 +25,14 @@
 
 ## Modes
 
-- **Normal**: Full 8 phases with code review + Plan Approval Gate
-- **Fast (multi-agent-dev)**: Init -> Dev(Opus) -> Review -> Test -> Commit -> Report
-- **Autopilot (multi-agent-autopilot)**: Skip confirmations, auto commit/PR
-- **Fastest (multi-agent-dev-autopilot)**: Combine dev + autopilot
-- **Local (multi-agent-local)**: Full 8 phases on current branch - no worktree
-- **Fast + Local (multi-agent-dev-local)**: Dev on current branch - no worktree
-- **Fastest + Local (multi-agent-dev-local-autopilot)**: Dev + autopilot, no worktree
+- **multi-agent**: worktree, asks Full or Short at Phase 0 Step 7.5
+- **multi-agent-local**: same question, no worktree - work on the current branch
+- **multi-agent-autopilot**: no confirmations, auto commit/PR, always Full
+- **multi-agent-local-autopilot**: same, no worktree
+
+Depth is the question, not a command: Full runs all 8 phases, Short is
+Init -> Dev(Opus) -> Review -> Test -> Commit -> Report. Review is never
+skipped either way. The multi-agent-dev* names were removed in v16.0.0.
 
 ## Language axes (en/tr)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mmerterden/multi-agent-pipeline",
-  "version": "15.16.0",
+  "version": "16.0.0",
   "description": "8-phase AI development pipeline with full orchestration on Claude Code, Copilot CLI and Codex CLI. Analysis, planning, TDD, CLI-aware parallel review with consensus surfacing + Fable triage, default-FAIL evidence gates, secret + intent guards, per-phase cost ledger, persistent learnings memory, wiki generation, commit automation. Token-preserving uninstall.",
   "type": "module",
   "main": "index.js",

package/pipeline/commands/multi-agent/SKILL.md

@@ -90,9 +90,8 @@ Lib scripts (`~/.claude/lib/`):
 | `stack [ios\|android\|backend\|mobile\|all]` | Swap skills for next conversation. No arg = show current stack. |
 | `language [en\|tr]` | Show or set the assistant `outputLanguage` (explanations and chat replies). `promptLanguage` is locked to `en` and is not toggleable. No arg = show current `outputLanguage`. With `en` or `tr` = set and persist `outputLanguage`. External payloads (commits, PR bodies, Jira) stay English. |
 | `setup` | Keychain token + Git Identity onboarding |
-| `--dev` | Dev-only: Init -> Dev(Opus) -> Review -> Test -> Commit -> Report |
-| `--dev autopilot` or `dev-autopilot` | Fastest path  -  Dev(Opus) + Review (auto-fix) + zero interaction |
 | `--local` | No worktree  -  works directly on local branch |
+| `--dev` and `dev-*` | **Removed in v16.0.0.** Depth is the Phase 0 Step 7.5 question, not a flag. Print the redirect and continue at `/multi-agent` (or `:local`) with Short selected; for the two autopilot names there is no equivalent, so print the stub's two options and stop. |
 | `autopilot` | Skip user confirmations, auto commit/PR |
 | No args / `help` | Show usage guide |
 
@@ -144,7 +143,7 @@ This command uses lazy loading for token efficiency. Read the relevant sub-file
 | `manual-test` | `$HOME/.claude/commands/multi-agent/manual-test/SKILL.md` |
 | `design-check` | `$HOME/.claude/commands/multi-agent/design-check/SKILL.md` |
 
-**Modifier flags** (`--dev`, `--local`, `autopilot`) and **ops** (`status`, `log`, `resume`, `kill`, `purge`, `review`) are parsed inline by this file  -  no separate spec files, they compose with the pipeline or do one-shot work.
+**Modifier flags** (`--local`, `autopilot`) and **ops** (`status`, `log`, `resume`, `kill`, `purge`, `review`) are parsed inline by this file  -  no separate spec files, they compose with the pipeline or do one-shot work.
 
 **How**: After routing, `Read` the relevant file and follow its instructions. Only load what the current action needs.
 
@@ -234,9 +233,9 @@ Save to `prefs.projects[{project}].branches`.
 
 ### Step 2  -  Mode Selection
 ```
-Pipeline mode:
-  1. Full pipeline (8 phases, Sonnet dev, parallel review + triage  -  CLI-aware reviewer set)
-  2. --dev (fast: Init → Dev(Opus) → Review → Test → Commit → Report  -  no analysis/planning)
+Pipeline depth (same question Phase 0 Step 7.5 asks):
+  1. Full  (8 phases, Sonnet dev, parallel review + triage  -  CLI-aware reviewer set)
+  2. Short (Init → Dev(Opus) → Review → Test → Commit → Report  -  no analysis/planning)
 Select [1/2]:
 ```